Computer science experts have long fought to raise awareness of electoral insecurity.
Photograph: David Becker/Reuters

The computer science experts who want the presidential election results audited don’t think a Russian vote-hacking operation is likely, either. But they’ve been upset for a decade that there’s no way to make sure.

Jeremy J Epstein, senior computer scientist at research center SRI International, said the effort to audit the vote “was and is a nationwide effort over a long period of time”. The Green party candidate, Jill Stein, has applied for a recount. The Clinton campaign has said it will cooperate.

“The Stein folks have somewhat hijacked the message, but I’m not worried,” Epstein said. “In fact, the goal of an audit is to verify [emphasis his] that the result was as originally reported.” Epstein describes himself as “75% confident that Trump won, and 25% that either there was an error in counting or there was a hack”.

US election recount: how it began – and what effect it could have

Read more

“Any accusation that it’s partisan and of-the-moment is ignorant of the history,” Epstein told the Guardian. Epstein, formerly of Princeton’s Center for Information Technology Policy, is one of the country’s foremost experts on election security and last year successfully crusaded to get insecure WinVote voting machines decertified and removed in Virginia.

Epstein has devoted years of time and energy to describing the frustrating process of voting machine certification and manufacture. Often, voting system regulators possess inadequate technical knowledge and make the certification process too cumbersome for successful hardware manufacturers to bother competing. The machines that eventually are certified are frequently underwhelming to security analysts.

The push to audit the vote is not new, but it is opportunistic: rarely have so many expressed concerns about the technical security of the election, and scientists who have spent more than a decade agitating for greater awareness of electoral insecurity are pleased that their voices are finally being heard.

J Alex Halderman, director of University of Michigan’s center for computer security and society, would only say that a hack of the vote was “plausible” in his affidavit added to Stein’s request for a recount. The more important point, to Halderman and many others who study voting machine security, is making sure there are reasonable security protocols in place: “The only way to determine whether a cyber-attack affected the outcome of the 2016 presidential election is to examine the physical evidence – that is, to count the paper ballots and paper audit trail records, and review the voting equipment, to ensure that the votes cast by actual voters match the results determined by the computers.”

The Stanford engineering professor David Dill, founder of the Verified Voting Foundation, said he supported Halderman. “In the statement, [Halderman] does not bring to light new evidence that the election was hacked,” Dill said. “However, he points out that there is ample reason to be concerned about it, and notes that we can’t really find out without getting a look at the ballots, which requires some candidate to ask for a recount. I strongly agree with this view. He says he and his students could have pulled off an election hack, and I have no doubt that that is true.”

During the 2016 election season, Russian intelligence services appear to have breached the Democratic National Committee, the Democratic Congressional Campaign Committee, and the emails for Hillary Clinton’s campaign chief, John Podesta. One hacking group in particular, known to cybersecurity researchers as Fancy Bear and believed to be operated by the Russian GRU intelligence agency, may have helped to coordinate the release of some information acquired from the Democrats.

But that is not the same thing as surgically hacking the vast patchwork of American voting systems in such a way as to turn three states that were not even considered swing states until election night so effectively that the outcome of the vote was reversed.

Now, as officials begin to listen to calls for security protocols that Halderman, Epstein and others believe ought to be routine, there is a danger that a jumpy public will perceive the audit as the work of sore losers crying wolf. There is plenty of reason for voting security advocates to be frustrated with the progress of their cause thus far: “It took years and lots of pilots to get audits added to the laws in California and Colorado; many other states have been experimenting,” Epstein said. “In Virginia, where I live, we had a law passed almost a decade ago to require an audit study; unfortunately, the study was done poorly, and the legislature didn’t act on the results.”

Dill and Epstein both had strong words for Trump, who, in the days before the election, said often that the “system” was “rigged” against him: “I would think that the Trump folks would endorse audits, because they would show that they won fair and square, which would eliminate the Bush-Gore contested results meme,” Epstein said.

Dill said: “The main concerns about election fraud during during the campaign came from the Trump campaign … If those concerns were sincere, the Trump campaign should also support some kind of manual recount or audit.”

Epstein added: “[For what it’s worth], the more I see of the statistical analyses, the more I expect that the audits will confirm the results. I think we’ll see the impact of voter ID laws depressing voter turnout, but not significant problems in the results themselves. There will be errors discovered – that’s unavoidable but they’ll largely be accidental.”